Re: Gmane's certificate

Joseph Mingrone <[email protected]> Mon, 15 Jan 2018 01:23:10 -0400
Newsgroups	gmane.discuss
Message-ID	<[email protected]>
Joseph Mingrone <[email protected]> writes:

> Hi,

> When trying to connect to news.gname.org [1], GnuTLS complains about the
> certificate [2].  A workaround is to download the certificate and update
> `gnutls-trustfiles' to point to it.  But, now that Let's Encrypt offers
> free certificates, could Gmane use a certificate issued by a recognized
> authority?

> Thanks,

> Joseph

> [1]
> (setq (gnus-secondary-select-methods
>    '((nntp "news.gmane.org"
>            (nntp-port-number 563)
>            (nntp-open-connection-function nntp-open-tls-stream))))

> [2]
> Checking new news...
> gnutls.c: [1] (Emacs) connecting to host: news.gmane.org
> gnutls.c: [1] (Emacs) allocating credentials
> gnutls.c: [2] (Emacs) allocating x509 credentials
> gnutls.c: [2] (Emacs) using default verification flags
> gnutls.c: [1] (Emacs) setting the trustfile:  /usr/local/share/certs/ca-root-nss.crt
> gnutls.c: [1] (Emacs) gnutls callbacks
> gnutls.c: [1] (Emacs) gnutls_init
> gnutls.c: [1] (Emacs) got non-default priority string: NORMAL
> gnutls.c: [1] (Emacs) setting the priority string
> gnutls.c: [2] HSK[0x3202000]: sent server name: 'news.gmane.org'

> gnutls.c: [1] (Emacs) non-fatal error: Resource temporarily unavailable, try again. [5358 times]
> gnutls.c: [2] GNUTLS_SEC_PARAM_LOW: certificate's issuer security level is unacceptable

> gnutls.c: [1] (Emacs) verification: certificate was signed with an insecure algorithm
> gnutls.c: [1] (Emacs) verification: the certificate was signed by an unknown and therefore untrusted authority
> gnutls.c: [1] (Emacs) verification: certificate could not be verified

And now the certificate has expired.

% gnutls-cli --crlf news.gmane.org -p nntps <<<QUIT
Processed 154 CA certificate(s).
Resolving 'news.gmane.org:nntps'...
Connecting to '195.159.176.226:563'...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
 - subject `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', issuer `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', serial 0x009398630d3ab6ffd6, RSA key 1024 bits, signed using RSA-SHA1, activated `2015-01-13 21:13:46 UTC', expires `2018-01-12 21:13:46 UTC', pin-sha256="V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y="
        Public Key ID:
                sha1:d21a01452b5a9b06106946930e64717869ff7ae0
                sha256:57f77efe178f9122f93329411b3bd9fdcdb5a8ccfe13d1f549fc8fd4d281af56
        Public Key PIN:
                pin-sha256:V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y=
        Public key's random art:
                +--[ RSA 1024]----+
                |=O+.ooo          |
                |+*o+ . .         |
                |= + + o          |
                | . + = o         |
                |  . + + S        |
                |   . . =         |
                |    . +          |
                |     E .         |
                |      .          |
                +-----------------+

- Status: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses insecure algorithm. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** handshake has failed: Error in the certificate.

_______________________________________________
Gmane-discuss mailing list
[email protected]
http://hawk.netfonds.no/cgi-bin/mailman/listinfo/gmane-discuss
signature.asc (application/pgp-signature, 962 B)